CVE-2025-22449 — Access control flaw for team admins allows unauthorized team additions
Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating …
Published: 2025-01-09 · CVSS: 3.8 · CVSS 3.1
Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allow_open_invite" field via making their team public.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7